The present invention relates generally to a postage metering system and method for evidencing postage payment in an open system and, more particularly, to a postage metering system and method for evidencing postage payment in a virtual meter configuration.
Postage metering systems have been developed which employ encrypted information that is printed on a mailpiece as part of an indicium evidencing postage payment. The encrypted information includes a postage value for the mailpiece combined with other postal data that relate to the mailpiece and the postage meter printing the indicium. The encrypted information, typically referred to as a digital token or a digital signature, authenticates and protects the integrity of information, including the postage value, imprinted on the mailpiece for later verification of postage payment. Since the digital token incorporates encrypted information relating to the evidencing of postage payment, altering the printed information in an indicium is detectable by standard verification procedures. Examples of systems that generate and print such indicium are described in U.S. Pat. Nos. 4,725,718, 4,757,537, 4,775,246 and 4,873,645, each assigned to the assignee of the present invention.
Presently, there are two postage metering device types: a closed system and an open system. In a closed system, the system functionality is solely dedicated to metering activity. Examples of closed system metering devices, also referred to as postage evidencing devices, include conventional digital and analog (mechanical and electronic) postage meters wherein a dedicated printer is securely coupled to a metering or accounting function. In a closed system, typically the printer is securely coupled and dedicated to the meter, and printing evidence of postage cannot take place without accounting for the evidence of postage. In an open system, the printer is not dedicated to the metering activity, freeing system functionality for multiple and diverse uses in addition to the metering activity. Examples of open system metering devices include personal computer (PC) based devices with single/multi-tasking operating systems, multi-user applications and digital printers. An open system metering device is a postage evidencing device with a non-dedicated printer that is not securely coupled to a secure accounting module. An open system indicium printed by the non-dedicated printer is made secure by including addressee information in the encrypted evidence of postage printed on the mailpiece for subsequent verification. See U.S. Pat. Nos. 4,725,718 and 4,831,555, each assigned to the assignee of the present invention.
The United States Postal Service (xe2x80x9cUSPSxe2x80x9d) has proposed an Information-Based Indicia Program (xe2x80x9cIBIPxe2x80x9d), which is a distributed trusted system to retrofit and augment existing postage meters using new evidence of postage payment known as information-based indicia. The program relies on digital signature techniques to produce for each envelope an indicium whose origin can be authenticated and content cannot be modified. IBIP is expected to support new methods of applying postage in addition to the current approach, which typically relies on a postage meter to print indicia on mailpieces. IBIP requires printing a large, high density, two-dimensional (xe2x80x9c2-Dxe2x80x9d) bar code on a mailpiece. The 2-D bar code encodes information and is signed with a digital signature.
The USPS has published draft specifications for IBIP. The INFORMATION BASED INDICIA PROGRAM (IBIP) INDICIUM SPECIFICATION, dated Jun. 13, 1996, and revised Jul. 23, 1997, (xe2x80x9cIBIP Indicium Specificationxe2x80x9d) defines the proposed requirements for a new indicium that will be applied to mail being created using IBIP. The INFORMATION BASED INDICIA PROGRAM POSTAL SECURITY DEVICE SPECIFICATION, dated Jun. 13, 1996, and revised Jul. 23, 1997, (xe2x80x9cIBIP PSD Specificationxe2x80x9d) defines the proposed requirements for a Postal Security Device (xe2x80x9cPSDxe2x80x9d), which is a secure processor-based accounting device that dispenses and accounts for postal value stored therein to support the creation of a new xe2x80x9cinformation basedxe2x80x9d postage postmark or indicium that will be applied to mail being processed using IBIP. The INFORMATION BASED INDICIA PROGRAM HOST SYSTEM SPECIFICATION, dated Oct. 9, 1996, defines the proposed requirements for a host system element of IBIP (xe2x80x9cIBIP Host Specificationxe2x80x9d). IBIP includes interfacing user, postal and vendor infrastructures which are the system elements of the program. The INFORMATION BASED INDICIA PROGRAM KEY MANAGEMENT PLAN SPECIFICATION, dated Apr. 25, 1997, defines the generation, distribution, use and replacement of the cryptographic keys used by the USPS product/service provider and PSDs (xe2x80x9cIBIP KMS Specificationxe2x80x9d). The specifications are collectively referred to herein as the xe2x80x9cIBIP Specificationsxe2x80x9d.
The IBIP Specifications define a stand-alone open metering system, referred to herein as a PC Meter comprising a PSD coupled to a personal computer (xe2x80x9cPCxe2x80x9d) which operates as a host system with a printer coupled thereto (xe2x80x9cHost PCxe2x80x9d). The Host PC runs the metering application software and associated libraries (collectively referred to herein as xe2x80x9cHost Applicationsxe2x80x9d) and communicates with one or more attached PSDs. The PC Meter can only access PSDs coupled to the Host PC. There is no remote PSD access for the PC Meter.
The PC Meter processes transactions for dispensing postage, registration and refill on the Host PC. Processing is performed locally between the Host PC and the PSD coupled thereto. Connections to a Data Center, for example for registration and refill transactions, are made locally from the Host PC through a local or network modem/internet connection. Accounting for debits and credits to the PSD is also performed locally, logging the transactions on the Host PC. The Host PC may accommodate more than one PSD, for example supporting one PSD per serial port. Several application programs running on the Host PC, such as a word processor or an envelope designer, may access the Host Applications.
The IBIP Specifications do not address an IBIP open metering system on a network environment. However, the specifications do not prohibit such a network-based system. Generally, in a network environment a network Server controls remote printing requested by a Client PC on the network. Of course, the Client PC controls any local printing.
One version of a network metering system, referred to herein as a xe2x80x9cvirtual meterxe2x80x9d, has many Host PCs without any PSDs coupled thereto. The Host PCs run Host Applications, but all PSD functions are performed on Server(s) located at a Data Center. The PSD functions at the Data Center may be performed in a secure device attached to a computer at the Data Center, or may be performed in the Data Center computer itself. The Host PCs must connect with the Data Center to process transactions such as postage dispensing, meter registration, or meter refills. Transactions are requested by the Host PC and sent to the Data Center for remote processing. The transactions are processed centrally at the Data Center and the results are returned to the Host PC. Accounting for funds and transaction processing are centralized at the Data Center. See, for example, U.S. Pat. Nos. 5,454,038 and 4,873,645, which are assigned to the assignee of the present invention.
The virtual meter does not conform to all the current requirements of the IBIP Specifications. In particular, the IBIP Specifications do not permit PSD functions to be performed at the Data Center. However, it is understood that a virtual meter configuration with each mailer""s PSD located at the Data Center may provide an equivalent level of security as required by the IBIP Specifications.
In conventional closed system mechanical and electronic postage meters a secure link is required between printing and accounting functions. For postage meters configured with printing and accounting functions performed in a single, secure box, the integrity of the secure box is monitored by periodic inspections of the meters. More recently, digital printing postage meters typically include a digital printer coupled to a metering (accounting) device, which is referred to herein as a postal security device (PSD). Digital printing postage meters have removed the need for physical inspection by cryptographically securing the link between the accounting and printing mechanisms. In essence, new digital printing postage meters create a secure point to point communication link between the PSD and print head. See, for example, U.S. Pat. No. 4,802,218, issued to Christopher B. Wright et al. and now assigned to the assignee of the present invention. An example of a digital printing postage meter with secure print head communication is the Personal Post Office(trademark) manufactured by Pitney Bowes Inc. of Stamford, Connecticut.
In U.S. Pat. Nos. 4,873,645 and 5,454,038, a virtual metering system and method are disclosed wherein the postal accounting and token generation occur at a data center remote from the postage evidencing printer. Although the Data Center may be a secure facility, there remain certain inherent security issues since the accounting and token generation functions do not occur in a secure device local to the postage printer. The virtual postage metering system includes a computer coupled to an unsecured printer and to a remote data metering system. The postal accounting and the token generation occur at the Data Center.
The Data Center is a centralized facility under the control of a meter vendor, such as Pitney Bowes, or the Postal Service. As such, it is regarded as secure compared to the environment that customers handle meters directly. However, data stored at the Data Center is accessible to Data Center personnel and, therefore, at a minimum, subject to at least inadvertent modification by such personnel. Any unauthorized changes to the user and meter data stored at the Data Center compromises the integrity of the virtual metering system.
It has been determined that a virtual postage metering system provides benefits that are not available under conventional postage payment systems. For the Posts, a virtual postage metering system provides central management of all postage without the need to manage physical meters or PSDs. A further benefit is the opportunity to directly associate a mailer to each mailpiece as opposed to each reset. For mailers, no metering hardware, i.e. postage meter or PSD, is needed. Nor do mailers need to maintain current lists of valid addresses, such as with purchased CD-ROMs. Mailers can acquire postage on an as-needed basis. Finally, meter vendors do not have to keep track of physical meters. A virtual postage metering system eliminates stolen or relocated meter problems and simplifies meter management in general.
The present invention provides digital data security for a Data Center of a virtual postage metering system that prevents inadvertent and intentional modifications to meter and user data stored at the Data Center. In accordance with the present invention security boxes are used to protect against unauthorized alteration of meter and user records stored at the data center. The present invention also provides secure control of digital token generation process and the associated secure accounting for each postage evidencing transaction occurring at the data center.
Security issues for the virtual postage metering system include user authentication, financial and postage transactions, and meter records. For the user authentication and meter records, the database hold encryption keys in cipher text and not in plain text. For each transaction, all data, including a time stamp or sequence number, used to complete the transaction are digitally signed and the signature is stored as part of the updated transaction record. It has been found that maintaining transaction records in this manner prevents inadvertent modification of the records.
Although the digital signature provides reasonable security, it is not bulletproof. It has been found that a historically signed record could be used in place of a current record requiring a more robust verification system to detect such xe2x80x9ctamperingxe2x80x9d. In accordance with the present invention, another level of security is added. It has been found that once the signature is verified, the transaction data can be checked for freshness to eliminate any possibility of tampering, inadvertent or intentional.
In accordance with the present invention, a system and method of evidencing postage payment provides a secure box is used to sign the transaction data and to authenticate meter and user records. The system and method includes a data center with a database having a plurality of meter records stored therein. Each meter record includes meter information corresponding to a metering account assigned to each of a plurality of remote user devices that are authorized to request evidence of postage payment. When a request for postage is received at the data center, a secure co-processor device in the data center obtains the appropriate meter record and verifies the authenticity of the meter record by verifying a signature in the meter record and comparing freshness data in the meter record to freshness data in the secure device. If verified, the secure device then accounts for an amount of postage to be evidenced, generating evidence of postage payment and updates the meter information, including the freshness data, in the meter record. The secure device then signs the updated meter information and stores the signature in the meter record. The secure device then returns the updated meter record to the database.